Discussion:
[iText-questions] Signing with setCertificationLevel broken in iText2.1.3
Paul Ryan
2008-07-25 00:40:31 UTC
Permalink
I've been using iText 2.1.2u and signing with a certification signature (certification level) using .setCertificationLevel(...) method on PdfSignatureAppearance object.  It has been working fine apart from it removing "enable usage rights in reader" setting on the PDF when enabled prior to signing it.
Unfortunately, the latest version of iText 2.1.3 doesn't appear to be working correctly with the same certification process.  I've run the exact same source code against version 2.1.2u and 2.1.3 and the 2.1.3 doesn't work, i.e. document not certified.  I've reverted back to using iText 2.1.2u for the time being.
...
PdfSignatureAppearance sap = stp.getSignatureAppearance();
sap.setCertificationLevel(PdfSignatureAppearance.CERTIFIED_FORM_FILLING);
...
Regards,
Paul


Start at the new Yahoo!7 for a better online experience. www.yahoo7.com.au
Bruno Lowagie
2008-07-25 06:04:09 UTC
Permalink
I've been using iText 2.1.2u and signing with a certification signature
(certification level) using .setCertificationLevel(...) method on
PdfSignatureAppearance object. It has been working fine apart from it
removing "enable usage rights in reader" setting on the PDF when enabled
prior to signing it.
Aha, "Usage Rights" rings a bell for me.
Normally, you can fill in a form using iText without removing
the usage rights. However, in versions prior to 2.1.3, the
usage rights were lost as soon as an end user saved the form.

The reason: iText replaced the complete XFA stream.
I changed this, so that only 2 parts were replaced.
I didn't replace any security stuff and this keeps
the usage rights intact.
Unfortunately, the latest version of iText 2.1.3 doesn't appear to be
working correctly with the same certification process. I've run the
exact same source code against version 2.1.2u and 2.1.3 and the 2.1.3
doesn't work, i.e. document not certified. I've reverted back to using
iText 2.1.2u for the time being.
Do you have any sample PDFs we can work with?
A temporary hack could be adding a flag to indicate
if the usage rights have to be kept or not.

br,
Bruno
Paul Ryan
2008-07-27 23:42:07 UTC
Permalink
Thanks for the response Bruno, and best wishes to yourself and family.
.
I've attached 3 sample files.
   (1)   Leave Form 4.pdf
   (2a) Leave Form 4_cert_itext212u.pdf
   (2b) Leave Form 4_cert_itext213.pdf
.
The (1) attachment sample is the base template used.  I used the same signing code to sign with a "self-signed" certificate into the Certification_Signature field using iText 2.1.2u and iText 2.1.3 libraries.  The (2a) sample should indicate it's a certified document ("This document was certified by xxxx with a valid signature and has restrictions") when opened by Adobe Reader 8, but the (2b) sample doesn't indicate that the document has been certified and has no restrictions in place (i.e it's just a normal signature by the looks; lost docMDP setting).
.
In these samples, I purposely didn't enable usage rights in the base template (1) to demonstrate the problem exists even without usage rights enabled.
.
Regards,
Paul



----- Original Message ----
From: Bruno Lowagie <***@lowagie.com>
To: Post all your questions about iText here <itext-***@lists.sourceforge.net>
Sent: Friday, 25 July, 2008 4:04:09 PM
Subject: Re: [iText-questions] Signing with setCertificationLevel broken in iText2.1.3
I've been using iText 2.1.2u and signing with a certification signature
(certification level) using .setCertificationLevel(...) method on
PdfSignatureAppearance object.  It has been working fine apart from it
removing "enable usage rights in reader" setting on the PDF when enabled
prior to signing it.
Aha, "Usage Rights" rings a bell for me.
Normally, you can fill in a form using iText without removing
the usage rights. However, in versions prior to 2.1.3, the
usage rights were lost as soon as an end user saved the form.

The reason: iText replaced the complete XFA stream.
I changed this, so that only 2 parts were replaced.
I didn't replace any security stuff and this keeps
the usage rights intact.
Unfortunately, the latest version of iText 2.1.3 doesn't appear to be
working correctly with the same certification process.  I've run the
exact same source code against version 2.1.2u and 2.1.3 and the 2.1.3
doesn't work, i.e. document not certified.  I've reverted back to using
iText 2.1.2u for the time being.
Do you have any sample PDFs we can work with?
A temporary hack could be adding a flag to indicate
if the usage rights have to be kept or not.

br,
Bruno

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
iText-questions mailing list
iText-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/itext-questions

Buy the iText book: http://www.1t3xt.com/docs/book.php



Find a better answer, faster with the new Yahoo!7 Search. www.yahoo7.com.au/search
Bruno Lowagie
2008-07-31 15:20:28 UTC
Permalink
Thanks for the response Bruno, and best wishes to yourself and family.
Sorry for the delayed reply (I've been ill and stuff).
I've attached 3 sample files.
(1) Leave Form 4.pdf
(2a) Leave Form 4_cert_itext212u.pdf
(2b) Leave Form 4_cert_itext213.pdf
.
The (1) attachment sample is the base template used. I used the same
signing code to sign with a "self-signed" certificate into the
Certification_Signature field using iText 2.1.2u and iText 2.1.3
libraries. The (2a) sample should indicate it's a certified document
("This document was certified by xxxx with a valid signature and has
restrictions") when opened by Adobe Reader 8, but the (2b) sample
doesn't indicate that the document has been certified and has no
restrictions in place (i.e it's just a normal signature by the looks;
lost docMDP setting).
.
In these samples, I purposely didn't enable usage rights in the base
template (1) to demonstrate the problem exists even without usage rights
enabled.
I think I found the reason (and I found another bug introduced
in iText 2.1.3), I've uploaded a patch to SVN, but I still have
to test it. I'll keep you posted.

best regards,
Bruno

Loading...